Parasite: planting durable backdoors against continual federated model fusion via discriminative feature pushing-pulling

Federated Learning (FL) is vulnerable to backdoor attacks due to its distributed nature, necessitating further study to understand and counter these threats. Unfortunately, existing studies suffer from limited backdoor durability, as their backdoor features insufficiently maintain the discriminability after attacks stop and benign model fusion continues. To tackle this, we propose a new backdoor attack framework on FL via discriminative feature pushing-pulling, namely Parasite, to perform durably effective backdoor attacks. Specifically, we first propose a target-aligned trigger generation module, which pulls backdoor features closer to target-class benign features, generating triggers as priors for backdoor injection to help plant stronger backdoors. Then, we propose a boundary separated backdoor injection module, which pushes target-class features away from others while pulling non-target shift features to align with the pre-poisoned ones, thereby improving backdoor durability with minimal impacts on utility. Extensive experiments demonstrate Parasite achieves high attack success rates and injects more durable backdoors than SOTA baselines by large margins (e.g. , up to 4.16 × and 16.06 × Lifespan on CIFAR-10 and GTSRB, respectively).